PT-2012-4954 · Apple · Safari

Aaron Sigel + 1 · Published 2012-09-20 · Updated 2017-08-29 · CVE-2012-3713

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 6.0.1

Description The issue arises from improper handling of the Quarantine attribute of HTML documents. This allows remote attackers to read arbitrary files on a user's system by leveraging the presence of a downloaded document, but it requires user assistance.

Recommendations For versions prior to 6.0.1, update to version 6.0.1 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-3713

Affected Products

Safari

References · 6

• http://support.apple.com/kb/HT5502 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2012/Sep/msg00005.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3713 · Security Note
• http://securityfocus.com/bid/55624 · Note
• http://osvdb.org/85652 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78679 · Note